Microsoft Entra groups
What it is
A group is a named list of directory objects in Microsoft Entra ID. It lets a team assign the same access or policy to many people or devices without repeating the assignment person by person.
Why it exists
Assigning access one person at a time is slow and easy to miss during staff changes. Assign an appropriate role or policy to a group, then manage membership. The assignment still needs least-privilege review; a group is a management tool, not an automatic permission level.
Key ideas
- Security group: commonly used to manage access to shared resources. Its members can include users, devices, and service principals.
- Microsoft 365 group: supports collaboration experiences; its membership model differs from a security group.
- Assigned membership: an owner adds and removes named members.
- Dynamic membership: Entra evaluates a rule against user or device attributes and updates membership. A dynamic group is for users or devices, not both at once.
- Nested groups: are possible in some cases, but do not assume every service or role assignment follows nested membership. Verify the target service’s behavior.
Northwind example
Maya creates Northwind-Order-App-Readers as a security group. She assigns the group a read-only role for the ordering workload, then adds the support staff who need that access. When Ana changes teams, removing Ana from the group removes the access delivered through that group assignment. For a broad, attribute-based population such as “employees in the Operations department,” Maya can evaluate a dynamic-membership rule—but she reviews the rule carefully because a bad attribute can grant access to the wrong people.
Exam notes
- Prefer a well-managed group over repeated individual assignments when the same access is genuinely shared.
- Dynamic groups are a recurring AZ-104 concept — membership updates automatically based on attributes.
- Know the difference between Assigned and Dynamic membership types.
Related
entraid · user-account · rbac · role-assignment
📘 Source: Microsoft Learn — Group types, membership types, and access management